Logpush without a pipeline to build
If you know Cloudflare Logpush, the idea is the same: the edge writes one line per request and ships the files to storage on a schedule. The difference is where the work sits. With a push product you create the destination bucket, hand over write credentials, define a job and keep all three working. Here the destination already exists and belongs to your account: switch delivery on, and the files are there to browse, download, pull or search. They stay in our object storage for 30 days; from there you can move them anywhere.
What every line contains
One JSON object per request: ts (ISO 8601 with its time zone), edge, client_ip, method, scheme, host, uri, protocol, status, bytes, cache (HIT, MISS, EXPIRED, STALE…), request_time, origin_time, referer, user_agent, country and asn. The files are gzip-compressed JSON Lines, so jq, Elasticsearch, BigQuery, Splunk and practically every log tool read them without a custom parser.
Search a time window on your own machine
The questions that come up during an incident are narrow: every request from one address, the 5xx responses on one path between 14:00 and 15:00. cdnctl logs grep answers them locally. It downloads only the five-minute files that overlap the window, skips any already on disk, and filters every line by IP (or CIDR block), status code or class, host, path, method, cache result, country or free text. cdnctl logs grep --from "2026-09-25 14:00" --to "2026-09-25 15:00" --status 5xx --path /api/ --format table prints a readable table; cdnctl logs grep --from 14:00 --ip 203.0.113.0/24 --count just counts. Your CPU and your disk do the work, and the lines never leave your control.
Pull a day into your own pipeline
cdnctl logs pull --day 2026-09-25 --out ./logs fetches every file of a UTC day. Run it again from cron and it downloads only what is new, which makes a nightly import into Elasticsearch, a SIEM or a data warehouse a one-line job.
Privacy and retention
Mask visitor IPs with one tick if you do not need them. Files are deleted automatically after 30 days. The edges hold a write-only key and cannot read anything back; the panel and cdnctl only ever list and sign files inside your account's own folder, and a download link expires after 15 minutes.
What it costs
Access logs are available on every package. Stored files count toward your monthly pool as storage at the month's peak — the panel says so before you switch delivery on — and compressed logs are small next to the traffic they describe. For summaries rather than raw lines (HTTP/3 share, status codes, cache and origin health) the Traffic quality page shows the same data at no cost.
How to set it up, step by step
Turn delivery on
Open Access logs in the panel for the account and switch delivery on. There is no bucket to create, no credentials to paste and no job to schedule: the destination is our object storage and your account's own folder in it.
Decide on visitor IPs
Logs carry the full visitor IP by default. If you do not need individual addresses, tick IP masking: IPv4 keeps its /24, IPv6 its /48. You are the data controller for these logs, so make the call before you switch delivery on.
Wait for the first files
Every edge that serves the account uploads the requests of the last five minutes as one file. The first files appear within about ten minutes.
Browse and download in the panel
The file list shows each file as a local time span and a location, with hour, location and text filters. A download link is valid for 15 minutes and only ever points inside your account's folder.
Pull or search from the terminal
cdnctl logs pull fetches a whole UTC day; cdnctl logs grep fetches only the files of a time window and filters every line on your machine. Both share one local cache, so nothing is downloaded twice.
Example scenarios
The 4xx rate jumps on the Traffic quality page. `cdnctl logs grep --from 14:00 --status 4xx --format table` shows the same client asking for the same path every ten seconds; one more grep with --ip and --count confirms it is a single forgotten probe, not an attack.
A cron job runs cdnctl logs pull after midnight and hands the new files to the security team's pipeline; nothing on the CDN side has to be configured for it.
A customer reports errors between 03:10 and 03:25. Grep that window for 5xx, see whether the edge or the origin answered, and attach the exact lines to the post-mortem.
Frequently asked questions
How often do new files arrive?
Every edge that serves your account uploads one file per five minutes, whenever it served requests in that window. Expect a delay of five to ten minutes; this is a log delivery, not a live stream.
How long are logs kept?
Thirty days, then they are deleted automatically. Pull anything you need to keep longer.
Does it cost extra?
No separate fee and no plan requirement. Stored files count toward your package's monthly pool as storage at the month's peak.
Can I mask visitor IPs?
Yes. With masking on, IPv4 addresses keep their /24 and IPv6 addresses their /48. The line format stays the same.
Why search locally instead of in the panel?
A day is hundreds of compressed files. Your machine scans them faster than a web page could, the lines stay under your control, and repeating the search with other filters uses the local cache instead of downloading again.
Which time zone are the times in?
The ts field carries its own offset. cdnctl reads a time without a zone as your computer's local time; the panel shows Türkiye time.